ALERTCritical PHP vulnerability · CVE-2026-109618 · CVE-2026-109619 · 21 Oct 2026
<?doiusephp?>
← Check your website

The October 2026 PHP security issue, explained

Last updated 22 October 2026

On 21 October 2026 the PHP project and the UK's National Cyber Security Centre (NCSC) warned about a critical security issue in PHP, the software behind a large share of the world's websites. Here's what it means if you own or run a website, in plain language.

What happened

Two flaws were found in PHP itself (CVE-2026-109618 and CVE-2026-109619). By sending a specially crafted request, an attacker can make a website's server run their own code, without logging in. In practice, that can mean taking over the server: changing the website, stealing data, or using it to attack others.

Who is affected

  • Every website that runs on PHP, whatever its PHP version, until it's updated to a fixed release. That includes most WordPress, Joomla, Drupal, Magento and PrestaShop websites.
  • Not your website itself if it's built with a hosted site builder that doesn't use PHP, such as Shopify, Wix or Squarespace. Other systems you use may still be affected.
  • Other software too: some appliances, intranets and business applications include PHP. The Dutch NCSC keeps a list of affected products.

Not sure about your website? Here's how to check, or run our free check.

What to do now

The NCSC advises, in this order:

  1. Update PHP to a fixed version. Your host, developer or agency usually does this.
  2. If you can't update yet, apply the temporary protections published by the PHP project.
  3. If neither is possible, consider taking the website offline until it's fixed.
  4. Check for signs of a break-in, especially if updating took a while.
  5. Watch for updates from the makers of other software and appliances you use.

Which PHP versions are fixed

  • PHP 8.5: fixed in 8.5.12 and newer
  • PHP 8.4: fixed in 8.4.27 and newer
  • PHP 8.3: fixed in 8.3.36 and newer
  • PHP 8.2: fixed in 8.2.35 and newer

PHP 8.1 and older no longer get security fixes at all. Websites on those versions need to move to a supported version, which takes more testing than a regular update, so start today.

For developers

All ways of running PHP for websites are affected (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed); mod_php carries the highest risk. If you can't patch immediately, php.net lists temporary mitigations, including administratively enforcing memory_limit=-1, tightening request and multipart limits, and session.upload_progress.enabled=0. They reduce the risk; they don't replace updating.

Not sure about your own website?

Check it now →

SOURCES